78 points by security_researcher 1 year ago flag hide 15 comments
johnsmith 1 year ago next
[HN Story Title] Node.js Security: Core Vulnerabilities, Best Practices and Beyond is out. After reading this, here are my thoughts...
johnsmith 1 year ago next
As a developer, I think it's crucial to stay updated on Node.js security issues and best practices. This post highlighting core vulnerabilities and then providing best practices is a great resource for the community.
jobsprogrammer 1 year ago next
This is a great point, securityexpert. Another thing to consider is using tools like NPM Audit or snyk to automatically detect security issues with your dependencies and get fixes.
securityexpert 1 year ago prev next
One thing I would like to add to the best practices section: Make sure you are using the latest version of Node.js and regularly updating your packages. This can mitigate a lot of security vulnerabilities before they even arise.
securecoding 1 year ago next
Absolutely! Here's another tool you can use: nsp (npm Security Platform). It has continuously passing builds and is permissionless to add to any repo. It will stop any of your ci pushes if it finds high severities.
backendmaster 1 year ago prev next
When it comes to Node.js, security is always one of my top priorities. I implement a variety of best practices to minimize the risk. This post is a must-read.
janejane 1 year ago next
The post mentions Express.js as a popular Node.js web app framework. I personally recommend using Helmet.js for a range of security features, including http security headers and CSP headers.
webdeveloper1 1 year ago prev next
Great post! Here is a list of additional Node.js security best practices that I always keep in mind when coding.
webdeveloper1 1 year ago next
1. Limit permissions for file system operations, network operations, or any operations that require permissions.
webdeveloper1 1 year ago prev next
2. Enable strict mode in Node.js code to ensure that variables and functions are scoped correctly and avoid any unexpected global variable changes.
webdeveloper1 1 year ago prev next
3. Use ES2015+ features for dependency management, like using object rest and spread properties, or spreading the utility module when needed. This approach can help reduce the number of dependencies.
webdeveloper1 1 year ago prev next
4. Regularly update dependencies and make sure to remove unnecessary packages to reduce the risk of vulnerabilities.
webdeveloper1 1 year ago prev next
5. Consider using a code coverage analysis tool, like istanbul or cupcake, to automatically generate code coverage reports. This can help identify potential security gaps.
jpenner 1 year ago prev next
I would also recommend using libraries and tools that adhere to the OWASP Security Principles, like MongoDB Connector for Node.js and the Express Framework.
webdeveloper1 1 year ago next
100% agreed, jpenner. When choosing libraries or tools, always consider their security properties and how well they align with the OWASP Security Principles.